Buffered viewing of electronic documents

• US 20060041837A1
• Filed: 06/07/2004
• Published: 02/23/2006
• Est. Priority Date: 06/07/2004
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Amir, Arnon, Megiddo, Nimrod
• Granted Patent: US 8,707,251 B2
• Time in Patent Office: Days
• US Class Current: 715/234
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A system, program storage device, and method of buffering an electronic document received from a host computer, wherein the method comprises determining whether an original source code of the electronic document includes executable coding which when executed by a client computer, causes the client computer to perform undesired operations, and producing an alternate source code of the electronic document, which eliminates the coding, wherein the undesired operations are characterized as undesirable based on predetermined settings established by the client computer. The electronic document comprises any of a web page, electronic mail message, an electronic mail attachment, a note in a hypertext format, a text document, a text file, and an application-specific electronic document. Each of the original source code and the alternate source code comprises a hypertext transfer protocol (HTTP) source code.

Claims

1. A method of buffering an electronic document received from a sender, said method comprising:

determining whether an original source code of said electronic document includes executable coding which when executed by a client computer, causes said client computer to perform undesired operations; and

producing an alternate source code of said electronic document, which eliminates said coding,

wherein said undesired operations are characterized as undesirable based on predetermined settings established by said client computer.

2. The method of claim 1, wherein said electronic document comprises any of a web page, electronic mail message, an electronic mail attachment, a note in a hypertext format, a text document, a text file, and an application-specific electronic document.

3. The method of claim 1, wherein each of said original source code and said alternate source code comprises a hypertext transfer protocol (HTTP) source code.

4. The method of claim 1, wherein said undesired operation comprises any of altering a configuration of said client computer, installing a code in said client computer, installing a plug-in command in said client computer, installing a program in said client computer, installing an application in said client computer, installing executable scripts in said client computer, saving a file in said client computer, reading a file in said client computer, transmitting a file from said client computer, and altering a file, security-related information, or personal settings from said client computer.

5. The method of claim 1, where said determining comprises establishing a set of rules and patterns for detection and inspection of different types of operations, system calls, registry alterations, and browser settings alterations on said client computer.

6. The method of claim 5, wherein said rules and patterns are learned from a set of samples using machine learning techniques comprising classifier training.

7. The method of claim 5, wherein said determining comprises:

gathering information and user decisions about controlled links in said electronic document, or a history of previous access to said electronic document or to a substantially similar document; and

using said information to adjust said set of rules.

8. The method of claim 1, wherein said producing is performed on any of said client computer, a server storing said electronic document, a proxy server attached to said client computer, and an intermediary computer operable for providing a security service to buffer said electronic document.

9. The method of claim 1, wherein said alternate source code disables linked items in said electronic document.

10. The method of claim 1, wherein said alternate source code controls access to linked items in said electronic document.

11. The method of claim 1, wherein said sender comprises any of a host computer, a server, and a program storage device.

12. The method of claim 1, further comprising allowing said client computer a choice of whether to substitute said original source code with said alternate source code.

13. The method of claim 1, further comprising presenting to said client computer a description of said coding.

14. The method of claim 13, wherein said description comprises an explanation of an effect to said client computer of accepting said coding by said client computer.

15. The method of claim 13, wherein said description comprises an identification of hidden commands and hidden links in said original source code.

16. The method of claim 13, wherein said description comprises a determination of a validity of information included in said coding.

17. The method of claim 13, wherein said description comprises instructions relating to scripts that run when said electronic document is retrieved by said client computer.

18. A method of filtering an electronic document received from a sender, said method comprising:

analyzing a first source code of said electronic document, wherein said first source code comprises;

first coding instructions which when executed by a client computer, causes changes in a configuration of said client computer which are undesired by said client computer, and

second coding instructions which when executed by said client computer, are incapable of altering the configuration of said client computer; and

generating a second source code of said electronic document, wherein said second source code substitutes said first coding instructions with said second coding instructions.

19. A system for filtering an electronic document received from a sender, said system comprising a buffer configured for determining whether an original source code of said electronic document includes coding which when executed by a client computer, causes changes in a configuration of said client computer which are unwanted by said client computer, wherein said buffer is adapted to produce an alternate source code of said electronic document, which eliminates said coding.

20. The system of claim 19, wherein said electronic document comprises any of a web page, electronic mail, and an application-specific electronic document.

21. The system of claim 19, wherein each of said original source code and said alternate source code comprises a hypertext transfer protocol (HTTP) source code.

22. The system of claim 19, wherein said alternate source code is adapted for disabling linked items in said electronic document.

23. The system of claim 19, wherein said alternate source code is adapted for controlling access to linked items in said electronic document.

24. The system of claim 19, wherein said alternate source code is adapted for disabling clickable items in said electronic document.

25. The system of claim 19, further comprising means for allowing said client computer to accept or delete said coding.

26. The system of claim 19, further comprising a user interface connected to said buffer, wherein said user interface is configured for presenting to said client computer a description of said coding.

27. The system of claim 26, wherein said description comprises an explanation of an effect to said client computer of accepting said coding by said client computer.

28. The system of claim 26, wherein said description comprises an identification of hidden commands and hidden links in said original source code.

29. The system of claim 26, wherein said description comprises a determination of a validity of information included in said coding.

30. The system of claim 26, wherein said description comprises instructions relating to scripts that run when said electronic document is retrieved by said client computer.

31. The system of claim 26, wherein said user interface is embedded into said alternate source code by adding a hypertext markup language (HTML) code and scripts to produce new mouse over information and controlled clickable items.

32. The system of claim 26, wherein said user interface is displayed in a separate window.

33. The system of claim 32, wherein said separate window is operable for controlling said electronic document in a primary window by altering said electronic document in said separate window and adding scripts that associate controls in said separate window with disabled or controlled operations in said primary window.

34. A system of filtering an electronic document received from a sender, said system comprising:

means for analyzing a first source code of said electronic document, wherein said first source code comprises;

first coding instructions which when executed by a client computer, causes changes in a configuration of said client computer which are undesired by said client computer, and

second coding instructions which when executed by said client computer, are incapable of altering the configuration of said client computer; and

means for generating a second source code of said electronic document, wherein said second source code substitutes said first coding instructions with said second coding instructions.

35. A program storage device readable by computer, tangibly embodying a program of instructions executable by said computer to perform a method of buffering an electronic document received from a sender, said method comprising:

determining whether an original source code of said electronic document includes coding which when executed by a client computer, causes said client computer to perform undesired operations; and

producing an alternate source code of said electronic document, which eliminates said coding,

wherein said undesired operations are characterized as undesirable based on predetermined settings established by said client computer.

36. The program storage device of claim 35, wherein said electronic document comprises any of a web page, electronic mail message, an electronic mail attachment, a note in a hypertext format, a text document, a text file, and an application-specific electronic document.

37. The program storage device of claim 35, wherein each of said original source code and said alternate source code comprises a hypertext transfer protocol (HTTP) source code.

38. The program storage device of claim 35, wherein said undesired operation comprises any of altering a configuration of said client computer, installing a code in said client computer, installing a plug-in command in said client computer, installing a program in said client computer, installing an application in said client computer, installing executable scripts in said client computer, saving a file in said client computer, reading a file in said client computer, transmitting a file from said client computer, and altering a file, security-related information, or personal settings from said client computer.

39. The program storage device of claim 35, where said determining comprises establishing a set of rules and patterns for detection and inspection of different types of operations, system calls, registry alterations, and browser settings alterations on said client computer.

40. The program storage device of claim 39, wherein said rules and patterns are learned from a set of samples using machine learning techniques comprising classifier training.

41. The program storage device of claim 39, wherein said determining comprises:

gathering information and user decisions about controlled links in said electronic document, or a history of previous access to said electronic document or to a substantially similar document; and

using said information to adjust said set of rules.

42. The program storage device of claim 35, wherein said producing is performed on any of said client computer, a server storing said electronic document, a proxy server attached to said client computer, and an intermediary computer operable for providing a security service to buffer said electronic document.

43. The program storage device of claim 35, wherein said alternate source code disables linked items in said electronic document.

44. The program storage device of claim 35, wherein said alternate source code controls access to linked items in said electronic document.

45. The program storage device of claim 35, wherein said alternate source code disables clickable items in said electronic document.

46. The program storage device of claim 35, further comprising allowing said client computer to accept or delete said coding.

47. The program storage device of claim 35, further comprising presenting to said client computer a description of said coding.

48. The program storage device of claim 47, wherein said description comprises an explanation of an effect to said client computer of accepting said coding by said client computer.

49. The program storage device of claim 47, wherein said description comprises an identification of hidden commands and hidden links in said original source code.

50. The program storage device of claim 47, wherein said description comprises a determination of a validity of information included in said coding.

51. The program storage device of claim 47, wherein said description comprises instructions relating to scripts that run when said electronic document is retrieved by said client computer.